20 



CLAIMS 

[30990131 US] 

1 . A method of classifying data traffic in a packet-based communications network 
conveying different classes of data, including the steps of: 
5 (a) monitoring a communications network for data traffic to identify a sequence of data 
packets of unknown class transmitted between a source address and a destination 
address; 

(b) measuring at ieast one parameter of at least a significant part of the packet sequence ? 
said parameter being any one of: 

10 - coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
15 transported from said destination address back to said source address; 

and 

(c) deriving from the measured parameter a probable classification of the data conveyed 
in the packet sequence. 

20 2. A method as claimed in claim 1 where the classification is between real-time 
data traffic and other data in the network. 

3. A method as claimed in claim 2 wherein the classification distinguishes between 
voice traffic and other traffic. 

25 

4. A method as claimed in claim 1 wherein the classification distinguishes between 
video traffic and other traffic. 

5. A method as claimed in claim 1 where in step (b) a plurality of different 
30 parameters are measured. 
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6. A method as claimed in claim 1 where in step (c) said classification is 
determined by a combination of processes based on different parameters, the results of 
each process being combined with the others in accordance with a specific weighting. 

5 1. A method as claimed in claim 1 where the measured parameter is the duration of 
said sequence, and sequences of longer duration are taken to indicate a high probability 
of real-time traffic. 

8. A method as claimed in claim 1 wherein the measured parameter is correlation 
10 between traffic in said sequence and traffic in a further sequence being transported from 
said destination address back to said source address, and correlation of periods of 
activity in one direction with periods of inactivity in the reverse direction is taken as an 
indicator of voice or videoconference traffic. 

15 9. A method as claimed in claim 1 wherein a plurality of parameters are measured, 
including timing parameters of individual packets within the sequence. 

10. A method as claimed in claim 9 where statistical analysis of the parameters is 
used to determine said classification, 

20 

1 L A method as claimed in claim 1 wherein a plurality of parameters are measured, 
including timing parameters of events in the sequence. 

12. A method as claimed in claim 1 1 wherein step (c) includes (i) deriving from the 
25 measured timing parameters one or more statistical properties of packet timing during 

at least a part of the sequence; and (ii) using said statistical properties to determine said 
classification. 

13. A method as claimed in claim 12 where said events comprise the arrival of each 
30 new packet for the sequence under investigation. 
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14. A method as claimed in claim 1 1 wherein the measured parameters include the 
intervals between events within said sequence. 

15. A method as claimed in claim 14 wherein the uniformity of said intervals over a 
J significant part of the sequence is taken to indicate a high probability of real-time 

traffic. 

16. A method as claimed in claim 15 wherein the intervals have a maximum 
duration of 20ms. 

10 

17. A method as claimed in claim 12 wherein the step (c)(i) includes filtering events 
to restrict the events whose measured parameters are included in the derivation of said 
statistical properties. 

15 18. A method as claimed in claim 17 wherein said filtering is performed so as to 
eliminate periods of inactivity from consideration in deriving said statistical properties. 

19. A method as claimed in claim 1 wherein said sequence is divided for analysis 
into a sequence of shorter measurement periods, and filtering is performed by reference 

20 to measurements from one measurement period at a time. 

20. A method as claimed in claim 19 wherein said period is typically 100ms. 

21 . A method as claimed in claim 19 wherein the filtering operates to omit or delete 
25 certain measurements from derivation of statistical properties of the measurements, or 

modifies those measurements and/or the statistical properties in some predetermined 
way. 

22. A method as claimed in claim 19 wherein only measurement periods preceded 
30 by periods containing significant activity are included in subsequent analysis. 
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23. A method as claimed in claim 19 wherein the first measurement within each 
measurement period is discarded to eliminate bias in the measurements made. 

24. A method as claimed in claim 19 wherein a separate record of the first 
5 measurement within each measurement period is kept which is later removed from a 

population for that measurement period. 

25. A method as claimed in claim 1 wherein the amount of raw data obtained by 
monitoring network traffic is reduced by aggregating data for separate measurement 

10 periods, and optionally for groups of measurement periods. 

26. A method as claimed in claim 1 including steps to compensate for variations in 
the packet arrival or other event times caused by outside influences and to 
accommodate specific traffic patterns, such as when the absence of a signal can lead to 

1 5 a misinterpretation of the data. 

27. A method as claimed in claim 26 wherein errors due to the intcr-packet arrival 
time are normalised against an expected arrival time. 

20 28. A method as claimed in claim 27 wherein an internal time reference is 
compared with arriving data packets so as to measure differences between actual arrival 
times and predicted arrival times. 

29. A method as claimed in claim I wherein said measurement includes further 
25 measurements of correlation between parameters of traffic in opposite directions of a 

duplex connection. 

30. A method as claimed in claim 29 where correlation between periods of high 
traffic in one direction and low traffic in the other are used as an indicator of voice 

30 traffic. 
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3L A method as claimed in claim 1 wherein additional measurements are used to 
distinguish multiple from single voice circuits and, where a connection is carrying 
multiple voice circuits, to take account of the particular attributes of such a connection. 

5 32. A method as claimed in claim 1 wherein timestamping of captured and re- 
assembled data packets is carried out on closure of the bit stream representing a data 
packet and written contiguous with the packet. 

33. A method as claimed in claim 1 wherein the process of timestamping packets is 
1 0 carried out separately from the detection and assembling of data packets. 

34. A method as claimed in claim 1 wherein the determined classification is used to 
automatically control configuration of the network, 

15 35. A method as claimed in claim 1 further comprising using the determined 
classification to report usage of the network for accounting purposes. 

36. Apparatus for classifying data traffic in a packet-based communications network 
conveying different classes of data, comprising: 
20 (a) monitoring means for monitoring a communications network for data traffic to 
identify a sequence of data packets of unknown class transmitted between a source 
address and a destination address; 

(h) measuring means for measuring at least one parameter of at least a significant part 
of the packet sequence, said parameter being any one of: 
25 - coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
30 transported from said destination address back to said source address; 

and 
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(c) classification means for deriving from the measured parameter a probable 
classification of the data conveyed in the packet sequence. 



